docs(adr): ADR-0133 — organization management, the open basics; mirroring cloud ADR-0081 D1/D3/D4 with Provenance

[os-warren]

Fixes #14508

⛔ DRAFT, and it stays draft. The diff touches docs/adr/**, a governed surface: the maintainer hand-merges. Do not flip ready, do not arm auto-merge.

One new file, docs/adr/0133-org-management-open-basics.md. Nothing else in the tree changes.

⭐ Update, 2026-09-07 — the dependency landed, so this file's account of it had gone stale

ADR-0132 is on main. The record that reverses cloud ADR-0081 D2 — The multi-organization runtime is open core — landed as docs/adr/0132-multi-organization-runtime-is-open-core.md (squash c677cda81, 2026-09-07 05:30 UTC), together with the now-open packages/plugins/organizations. Measured, not assumed: on origin/main, git log --oneline | grep -c for that PR's squash suffix returns 1 (control: a known-landed sibling PR also returns 1), the ADR file resolves under git cat-file -e origin/main:docs/adr/0132-..., and so does the package manifest.

Six places in this file were written against the opposite fact. Each is anchored by its text, not by a line number:

where	was	now
header bullet - **Deliberately not mirrored**:	D2 and its consequences "govern a packaging choice, stay in cloud"	D2 is not mirrored because it has been reversed; what stays in cloud is that record, together with the non-goals and the commercial consequences the reversal leaves untouched — the machinery now ships in this repository. The in-file link target moves with the heading below
section heading ## Relationship to the D2 reversal (…)	headed with the PR number; body called the record "open as a draft PR … and is not yet on main"	headed (ADR-0132); body cites [ADR-0132](./0132-multi-organization-runtime-is-open-core.md) and states plainly that it landed
the same section's second paragraph	"⛔ It is referenced here by PR number and never by its ADR number … When it merges, its number becomes citable and this file should be updated to use it"	cites by ADR number and relative link; the squat constraint is recorded as discharged, in the past tense, so the next reader knows why the PR reference ever existed
division-of-labour table, the D2 row	"the record proposed in" that PR	"reversed by ADR-0132, which is on main"
⚠️ A note for the hand-merge	"That option was not available to this change: the file does not exist on main"	the obstacle is stated as past — ADR-0132 has landed — and the merit that survived its merge is now named: that record carries its own D1 through D6, different decisions from cloud ADR-0081's D1/D3/D4, so folding this mirror into it would put two unrelated D1s in one document, which is precisely what the deliberately unrenumbered mirror exists to keep checkable. Stated, not decided: this change takes the option neither way, and the disposition stays a merge-time call
What this record does not decide, item 4	"the record proposed in" that PR	[ADR-0132](./0132-multi-organization-runtime-is-open-core.md)

The file wrote its own trigger for this edit, and the condition is now met. Zero occurrences of the old PR number survive anywhere in the file (grep -c returns 0).

⛔ Nothing about the reversal is re-derived, restated or evaluated here. ADR-0132 records, in its own "What this record does not decide" section, that it does not touch cloud ADR-0081 D1, D3 or D4 — which are this file's entire content. The two records stay disjoint; this one only cites.

origin/main was merged into the branch (merge commit c83097a1f) so the newly-cited record exists in the tree the gates read. The PR's own diff is still exactly one file.

What it records

The open-mechanism half of cloud ADR-0081 (Accepted, founder-decided in session, 2026-07-09), stated as this repository enforces it — D1 (adding a teammate is open and always goes through better-auth invitations), D3 (the in-shell surface is the organization record page behind a templated nav deep-link) and D4 (control-plane roster reads are organization-scoped).

⛔ It decides nothing. The cloud D-numbers are kept unrenumbered — a mirror a reader cannot line up against its original is not checkable — so the sequence reads D1, D3, D4 with D2 visibly absent.

Where a local record already decides a point, the file cites it instead of restating it: ADR-0093 (membership lifecycle; its D9 already anchors the active-organization resolution the code cites as "ADR-0081 D1"), ADR-0105 D12 (the multi-org entitlement anchor), and ADR-0131 D1/D7/D9 (total organization ownership). Per the card's later pointer comment, D4 does not decide whether sys_member keeps its organization column — that is ADR-0131 D7's writer-facts question, answered by the C6 census in #15207, which the file cites and leaves alone.

The ADR number: 0133

• ls docs/adr/ on origin/main at 77781151d, when the file was written — the highest record was 0131.
• 0132 was claimed by an open PR at that moment, which is why this file took 0133.
• All 40 then-open PRs were listed and scanned for an ADR-number claim; only that one carried one.

⇒ 0133, and the number below it is no longer a gap: 0132 is a real, merged record.

⭐ Two findings that shaped how the file is written

1. A line-number anchor in an ADR is a hard gate failure. The card supplied three file.ts plus line-offset positions. check:adr-symbol-anchors (the #13556 migration, maintainer ruling 2026-09-01) makes any surviving line anchor under docs/adr/** a finding with no transition period — the census behind it measured 243 of 337 line anchors already broken. Every anchor in this file is therefore a symbol anchor (path#symbol) or a file-level path, and the gate re-confirms it: 0 line anchors survive.

2. The record being cited could not be named by number — and now can. The file originally cited ADR-0132 by number and check:adr-anchors failed: a citation of an ADR number naming no record under docs/adr/ is a squat, retroactively falsified if the record lands under a different number. The reversal was therefore referenced by PR number, with the reason recorded in the file so the next author would not undo it. That constraint is discharged by this round — the record exists, the number resolves, and the gate stays green with the citation in place.

Open question left for the hand-merge, not resolved here

⭐ "Opens on tab-0 Members" is asserted in this repo's comments but declared by none of its metadata. Measured on origin/main at 77781151d and re-checked on today's origin/main: no object under packages/platform-objects/src/identity/ declares the relatedList prominence key — the key objectui reads to promote a child list to its own tab — and no relatedLayout override exists anywhere in this repository. Under the documented default with no primary list declared, related lists collapse into a single stacked tab. Two source comments and a QA checklist item nevertheless describe a Members/Invitations/Teams tab strip.

So the ADR states the deep-link contract, which is declared, and does not assert a tab order, which is not — and records the discrepancy under "What this record does not decide" rather than repairing it. Filed separately; ⛔ not fixed in this PR.

Observed while re-checking, deliberately not touched

docs/adr/0132-multi-organization-runtime-is-open-core.md still carries - **Status**: Proposed (2026-09-06) — awaiting the maintainer's hand-merge although it has merged. That is residue on another record, owned by whoever lands its correction; ⛔ nothing in this PR edits it.

Scope held

⛔ Not touched, deliberately: the cloud-repo pointer comment on cloud ADR-0081, and #14361's re-pointing of the bare ADR-0081 citations across packages/platform-objects/src/identity/** and plugin-auth — both belong to other cards. No code and no metadata changed, so the card's Clause-②: no still holds as declared.

Changeset

Judged, not defaulted: skip-changeset applies. The diff publishes nothing from any package — it adds one file under docs/adr/, which no package ships and no package.json references. That is the rule the label encodes, and docs/adr/** is the documented example of it. The label was applied additively and read back on an earlier round; it is present on this PR now.

Verification

Gate set derived mechanically on the final commit — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, which reports its own provenance (derived from the tree of 'objectstack-ai/objectstack' at commit 01b450d40) and takes its change set from the merge base rather than a hand-built diff.

17 commands derived, 17 green at 01b450d40 — the union was re-derived and re-run in full after the final commit, and the derivation confirmed the same 17-command family. Each exit code was captured immediately after a single redirected command, never through a pipe. The verdict lines are the gates' own:

• check-adr-symbol-anchors — 1970 anchors across 137 records resolve — 218 symbol (195 declaration, 23 literal), 1729 file-level, 23 cross-repo, 6 exempt, 3 continuation. 0 line anchors survive.
• check-adr-anchors — OK (53 anchored file(s), every governing ADR still referenced; 131 decision number(s), each naming one decision or an allowlisted pair; 33638 citation(s) across 4260 file(s) resolve; 997 decision-letter citation(s) on the anchored surface name a decision the record makes).
• check-adr-links — 667 relative link destination(s) under docs/adr/ resolve (this is what re-checks the new relative links and the heading anchor the header bullet points at)
• check-doc-authoring — 396 files clean — no bare metadata literals
• check-nul-bytes — OK (scanned 8128 text file(s) … no raw ASCII control bytes)
• check-closing-keyword-parity — OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8135 tracked file(s), all registered).
• the remaining derived commands — check-ci-filter-parity, check-comment-mask-corpus, check:cross-package-test-inputs, check:driver-memory-census, check:pm-governed-merges, check:refd-timer-probe, check:watch-hint-literal, and the four --self-test halves — all exit 0.

One gate first answered exit 3 — PREREQUISITE NOT MET, which is neither a pass nor a finding: @objectstack/lint's check:doc-formula-expressions refuses to run against unbuilt workspace output. It was cleared rather than reported, by building the two packages it names through the shared verify lock (scripts/pm/os-verify-lock.sh — VERDICT command-exit 0 · held the lock 188s · waited 0s), then re-run to a real reading: 22 record-scoped formula example(s) across 432 files / 1371 TS blocks judged clean, plus its spec-TSDoc and field-level legs.

Governance predicate, asserted rather than assumed: node scripts/pm/check-governed-merges.mjs --test docs/adr/0133-org-management-open-basics.md → exit 3, GOVERNED, "a human merge is the review record for this PR". That is the intended reading, not a failure.

The repo-wide pnpm lint sweep is CI's; the local scope was narrowed and the narrowing is measured, not assumed. Three readings: the population comes from eslint's own flat config, not from a guess — run against the changed path it answers "File ignored because no matching configuration was supplied"; --format json reports 0 linted files for that path (one entry, errorCount: 0, carrying only the ignore notice); and no eslint configuration file is in this diff, so no untouched file's verdict can move either. No CI state is predicted here.

---

Generated by Claude Code

[os-warren]

PM verification — PASS on the record itself · ⚠️ one decision escalated, NOT resolved by me

Measured at head d9954a55d. ⛔ Do not hand-merge this on my say-so — read the escalation first.

⛔ First, my error, because it shaped the brief this seat worked to

I dispatched this card from its body alone. Its comments carry two pointers that change the job, and one of them — the triage comment 5545413919 — literally says 「认领前请读它」 (read it before claiming). I did not. So my dispatch brief (5558046264) framed PR #16215 as a number collision when @hotlong's pointer 5557377980 had framed it as a writer collision, with an explicit instruction:

⛔ Two writers must not both write the ADR-0081 record. … extend ADR-0132 with the D1/D3/D4 decisions and their code anchors, rather than opening a second local mirror of the same cloud record.

The seat did not miss this. It read the comment, saw that it contradicted its binding brief, refused to resolve the conflict silently, and recorded it both in its report and inside the ADR under Relationship to the D2 reversal. That is the correct behaviour and I want it on the record as such — the failure was upstream of it, in my briefing.

⭐ The obstacle the pointer could not have accounted for — measured

Two independent reasons "extend ADR-0132" cannot be executed as written, both checked here rather than argued:

1. ADR-0132 does not exist on origin/main. git ls-tree -r origin/main docs/adr/ | grep -c 0132 → 0; highest is 0131. It lives only on feat(organizations): bring the multi-organization runtime back to open core — the org-scoping registrar ships open, the licence gate stays in cloud (ADR-0132) #16215's branch (claude/issue-16130-open-org-scoping), a draft on a governed surface awaiting hand-merge. Extending it would mean basing this branch on an unmerged governed PR and coupling two hand-merges into one.

2. ⭐ ADR-0132 already has its own D1, D3 and D4 — and they are different decisions:

   	ADR-0132's own	cloud ADR-0081's (this card's)
   D1	The multi-organization runtime is open core	Adding a teammate is open, via better-auth invitations
   D3	One name, two packages; the declaring manifest decides which	The in-shell surface is the org RECORD page
   D4	The open package entitles both walled postures	Control-plane roster reads are org-scoped

   Folding this card's D1/D3/D4 into that file would give one record two different D1s, two different D3s and two different D4s. That is not a mirror a reader can check against its original — it is the opposite.

   ⭐ And ADR-0132's own body already scopes itself away from them: "D1, D3 and D4 of that record are untouched — see What this record does not decide."

⚠️ I am stating this as evidence for the decision, not as my overruling of it. The instruction is the maintainer's and this is a human-merge surface.

The decision I am escalating

A — land 0133 as a disjoint record (what this PR does). The two files decide nothing in common, so folding them later is a move, not a rewrite.
B — hold this card until #16215 merges, then extend that file. Honours the pointer literally, at the cost of blocking a ready card on another seat's governed hand-merge for an unbounded time, and still leaves the duplicate-D-number problem to solve.

My reading is A, on the two measurements above. ⛔ But @hotlong wrote the pointer and filed the card; if the answer is B, say so and I will hold the card — the seat's work is not wasted, it becomes the extension text.

The record itself — verified

• One file, docs/adr/0133-org-management-open-basics.md, +267. Nothing else in the diff.
• ⭐ Zero line anchors. grep -cE '\.ts:[0-9]+|\.json:[0-9]+' → 0. This matters: check:adr-symbol-anchors makes a path:NNN anchor a hard finding under docs/adr/** ([finding] ADR line anchors into sql-driver.ts have rotted — 4 of 4 sampled resolve to unrelated code, and the ADRs read as if they still point at the mechanism they name #13556, maintainer ruling 2026-09-01, explicitly no transition period), so the card's own three offsets (sys-member.object.ts:47, invite-entry-toolbar.test.ts:4, sys-user.object.ts:59) could not be used at all. The seat pre-verified every replacement against the gate's own resolver and let it reject three candidates rather than shipping them.
• Zero ADR-0132 citations — the first draft cited it by number, check:adr-anchors failed exit 1 because a number naming no record under docs/adr/ is a squat, and the seat replaced every token with a PR reference. ⭐ That is the same failure as this card's own, seen from the other side, and it caught it.
• D-numbering preserved: ### D1, ### D3, ### D4 with D2 visibly absent — cloud's numbering kept unrenumbered so the mirror lines up against its original.
• Cross-check honoured, including the pointer I failed to relay: ADR-0093 D9, ADR-0105 D12 and ADR-0131 D1/D7/D9 are cited rather than restated, and ⛔ D4 does not decide whether sys_member keeps its column — deferred to ADR-0131 D7's writer-facts question and the C6 census (feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207), exactly as 5536478826 required.
• Number 0133 derived from the tree and re-derived immediately before committing, checked against main, feat(organizations): bring the multi-organization runtime back to open core — the org-scoping registrar ships open, the licence gate stays in cloud (ADR-0132) #16215's branch, and all 40 open PRs. A number free on main is not free if an open PR claims it.

Gates

17/17 green at the final head, family derived mechanically. One answered exit 3 = PREREQUISITE NOT MET (check:doc-formula-expressions, refusing to run against unbuilt output) — ⭐ cleared into a real measurement rather than reported as a pass, by building the two packages it names and re-running it green. The cross-repo objectui anchors are skipped-not-judged by default, so the gate was re-run with OBJECTUI_CHECKOUT set and both anchors left the skipped list — ⭐ skipped is not green, and the seat did not let it read as such.

Out of scope, filed not fixed

#16270 — "the org record page opens on tab-0 Members" is asserted in three places but declared by no metadata: zero relatedList prominence keys under packages/platform-objects/src/identity/, no relatedLayout override anywhere, so objectui's documented default collapses every related list into one stacked Related tab. The ADR therefore states the deep-link contract (which is declared) and does not assert a tab order (which is not). ⭐ The issue deliberately does not pick between "metadata missing a declaration" and "three documents stale" — telling them apart needs the running app. Correct call; declaring the key here would have been a metadata change the Clause-②: no forbids.

Status: Clause-②: no holds as declared — no code, no metadata. Draft, ready never flipped, auto-merge never armed, skip-changeset judged rather than defaulted. ⛔ Governed surface: human merge, and the A/B question above is owed an answer first.

---

Generated by Claude Code

[os-zhuang]

Contract review (clause ②) — no gate · ⛔ GOVERNED — human merge only — PR #16267 at head d9954a55 (Fixes #14508)

Director seat at tier (claude-fable-5-1, session session_01TezFG8ZMrNH6n5VTNpPpdH), 2026-09-06 09:28Z, on the label applied 09:11Z.

Clause ② answer: no. One new file under docs/adr/; no package ships it, no .d.ts, no payload, no accept/reject set moves. skip-changeset is the right disposition and was applied by the seat at 09:05Z; the one Check Changeset failure on this head ran at 08:49Z, before the label, and the two runs after it are skipped — nothing owed there.

Landing: node scripts/pm/check-governed-merges.mjs --test docs/adr/0133-org-management-open-basics.md answers ⛔ GOVERNED (docs/adr/**, #9495 regime): a human merge is the review record, and no seat flips ready, enqueues or arms — exactly what the PR body already states. The record's own gates (check-adr-symbol-anchors, check-adr-anchors, check-adr-links, 17/17 derived) are green at this head.

Not adjudicated here, deliberately: the domain:services seat's escalation (5558242242) — whether this lands as a disjoint ADR-0133 or is folded into #16215's ADR-0132 per the earlier pointer — is a maintainer question on a human-merge surface, and it sits in that seat's box, not the director's. This verdict only records that the carrier is clause-② clean and governed.

needs:contract-review comes off this PR now (card #14508 never carried it, and a label on a human-merge surface would gate nothing).

---

Generated by Claude Code

[os-warren]

PM 独立复核 —— PASS。依赖已落地的更新到位，红也没了

复核在独立 worktree 里 checkout 到 head 01b450d40，⛔ 不采信席位报告，⛔ 不使用共享主 checkout（本会话已因它的陈旧工作树出过一次实错）。

1. 那条红：陈旧读数，已消失

Check Changeset 08:49 那次失败跑在 skip-changeset 标签打上之前（日志原文 "This PR adds no changeset … apply the 'skip-changeset' label"），之后同名检查全部 skipped。PM 重跑了那个 workflow run，席位又推了新提交。

新 head 上实测：33 个 check run，0 个 failure。 Check Changeset = skipped；Part-of PR must not also close its card = success（⇒ 席位的提交信息没有携带卡关系尾注，RULE 2 满足）。唯一未完成的是 Lint & Repo Gates（in_progress），⛔ 不预测它。

2. 门禁，PM 自跑

门	我的读数
check-governed-merges.mjs --test docs/adr/0133-org-management-open-basics.md	EXIT=3 · GOVERNED ⇒ 仍需人工合并，⛔ 不 arm
check-adr-anchors.mjs	EXIT=0 ⭐ 这条的意义变了：ADR-0132 以前不存在，按号引用会被判 squat；现在它是真记录，按号引用合法且绿
check-adr-symbol-anchors.mjs	EXIT=0 — 1970 anchors across 137 records resolve … 0 line anchors survive
check-adr-links.mjs	EXIT=0 — 667 relative link destination(s) under docs/adr/ resolve ⇒ 覆盖了新增的相对链接和被改名的小节锚点

3. 交付面

检查	读数
三点 diff	1 个文件，仍是 docs/adr/0133-org-management-open-basics.md
旧 PR 号 16215 残留	0 处
ADR-0132 按号 + 相对链接引用	5 处（头部条目、小节标题、小节正文、分工表 D2 行、「不裁决」第 4 条）
path:NNN 行锚点	0 处
ADR-0132 落地佐证	c677cda81 feat(organizations): … (ADR-0132) (#16215) 在 origin/main 上

4. 席位声明的偏离 —— 接受

它把 origin/main 本地合并进了分支（merge commit c83097a1f）。我的简报 ⛔ 的是 update_pull_request_branch（当推动手段用），不是本地合并；那个 API 也确实没被调用。

⭐ 而且它给的理由成立且是我没预见到的：check-adr-anchors 与 check-adr-links 读的是工作树，而 ADR-0132 在基于 77781151d 的分支上根本不存在 ⇒ 我要求的「必须 exit 0」在不把那份记录带进树里的情况下字面上无法达成。PR diff 仍是 1 个文件。

5. ⭐ 席位多做的一处，是对的

我列了 5 处要改，它改了 6 处（小节第二段是独立站点，同时承载「按 PR 号引用」的规则与本文件自己的更新触发条件），并从卡的评论历史里读出了第 7 处：

ADR-0132 carries its own D1 through D6, which are different decisions from cloud ADR-0081's D1/D3/D4, so folding this file into it would put two unrelated D1s in one document — the property the unrenumbered mirror above exists to keep checkable.

⇒ 之前「不能并进 0132」的理由是它还没合并；那个障碍随合并消失了，但另有一个结构性障碍幸存。文件把它陈述出来而不裁决，并明说合并时若维护者要合成一份，那是 merge-time 的决定、两份不相交、是移动不是重写。⭐ 这正是正确姿态：⛔ 席位不替维护者选。

6. 只报不改的两条

• ADR-0132 已于 c677cda81 落地，但它自己的 Status 仍写 Proposed (2026-09-06) — awaiting the maintainer's hand-merge，并写着「⛔ Nothing below is settled until this record merges」。 那是别的席位的记录，⛔ 本 PR 不动它；已另行路由到 Bring single-database multi-organization isolation back to the open core — the wall is already open, only the org-scoping switch is closed (~1350 of 1660 lines move; the licence gate stays) #16130。
• 本文件 Provenance 段仍写「measured on origin/main at 77781151d」。⭐ 席位判断那是测量时点的诚实陈述而非时效声明，不该在未重量的情况下改 sha —— 我认同。它另外复量了那条唯一承重的否定性断言（identity 下无 relatedList prominence 键），在今天的 origin/main 上仍成立。

⛔ 保持 draft，等人工合并。 PM 未 flip ready、未 arm auto-merge、未 update_pull_request_branch。

---

Generated by Claude Code

[os-zhuang]

Escalation answered by the maintainer's own act — option A, land ADR-0133 as a disjoint record (director seat, 2026-09-07)

The A/B question in the PM verification comment (5558242242) — land 0133 as its own record, or hold and fold into #16215's ADR-0132 — was put to the maintainer in the governed-PR presentation. The maintainer approved this PR, flipped it ready and added it to the merge queue at 07:19:25Z. That act is the answer: A. The two records decide nothing in common; if a later consolidation is wanted it is a move, not a rewrite.

Recorded so the earlier pointer ("extend ADR-0132") is read as superseded by measurement (ADR-0132's own D1/D3/D4 are different decisions) and by this ruling, not silently dropped.

---

Generated by Claude Code